Skip to main content

max / makenotwork

8.6 KB · 288 lines History Blame Raw
1 //! Contact sharing and revocation workflow tests.
2 //!
3 //! Covers: revoke via API, verify creator can't see contact, re-purchase with
4 //! share_contact clears revocation, idempotent revoke, auth required, CSV export
5 //! email redaction.
6
7 use crate::harness::TestHarness;
8 use makenotwork::db;
9 use serde_json::Value;
10
11 /// Helper: create a seller with a published project + $10 item + 100% promo code.
12 /// Returns (seller_id, item_id) with the seller logged out.
13 async fn setup_seller_with_discountable_item(h: &mut TestHarness) -> (db::UserId, String) {
14 let seller_id = h.signup("seller", "seller@test.com", "password123").await;
15 h.grant_creator(seller_id).await;
16 h.client.post_form("/logout", "").await;
17 h.login("seller", "password123").await;
18
19 let resp = h
20 .client
21 .post_form("/api/projects", "slug=shop&title=Shop")
22 .await;
23 let project: Value = resp.json();
24 let project_id = project["id"].as_str().unwrap();
25
26 let resp = h
27 .client
28 .post_form(
29 &format!("/api/projects/{project_id}/items"),
30 "title=Product&item_type=digital&price_cents=1000",
31 )
32 .await;
33 assert_eq!(
34 resp.status, 200,
35 "Create item failed: {} {}",
36 resp.status, resp.text
37 );
38 let item: Value = resp.json();
39 let item_id = item["id"].as_str().unwrap().to_string();
40
41 // Publish both
42 h.client
43 .put_json(
44 &format!("/api/projects/{project_id}"),
45 r#"{"is_public": true}"#,
46 )
47 .await;
48 h.client
49 .put_form(&format!("/api/items/{item_id}"), "is_public=true")
50 .await;
51
52 // Create a 100% discount promo code (makes checkout free-claim path)
53 let resp = h
54 .client
55 .post_form(
56 "/api/promo-codes",
57 "code=FREE100&code_purpose=discount&discount_type=percentage&discount_value=100",
58 )
59 .await;
60 assert_eq!(
61 resp.status, 200,
62 "Create promo code failed: {} {}",
63 resp.status, resp.text
64 );
65
66 h.client.post_form("/logout", "").await;
67 (seller_id, item_id)
68 }
69
70 /// Buyer purchases the item via 100% discount promo code with share_contact.
71 async fn buyer_purchase_with_share_contact(h: &mut TestHarness, item_id: &str) {
72 let resp = h
73 .client
74 .post_form(
75 &format!("/stripe/checkout/{item_id}"),
76 "promo_code=FREE100&share_contact=true",
77 )
78 .await;
79 // 100% discount → free claim → redirect
80 assert_eq!(
81 resp.status, 303,
82 "Purchase with share_contact failed: {} {}",
83 resp.status, resp.text
84 );
85 }
86
87 #[tokio::test]
88 async fn revoke_hides_contact_from_seller() {
89 let mut h = TestHarness::new().await;
90
91 let (seller_id, item_id) = setup_seller_with_discountable_item(&mut h).await;
92
93 // Buyer: sign up and purchase with share_contact=true
94 let _buyer_id = h.signup("buyer", "buyer@test.com", "password123").await;
95 buyer_purchase_with_share_contact(&mut h, &item_id).await;
96
97 // Verify seller can see the contact
98 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
99 .await
100 .unwrap();
101 assert_eq!(
102 contacts.len(),
103 1,
104 "Seller should see 1 contact before revocation"
105 );
106 assert_eq!(contacts[0].email, "buyer@test.com");
107
108 // Buyer revokes contact sharing
109 let resp = h
110 .client
111 .delete(&format!("/api/contacts/{}", *seller_id))
112 .await;
113 assert_eq!(
114 resp.status, 204,
115 "Revoke should return 204, got {}",
116 resp.status
117 );
118
119 // Verify seller can no longer see the contact
120 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
121 .await
122 .unwrap();
123 assert!(
124 contacts.is_empty(),
125 "Seller should see 0 contacts after revocation"
126 );
127 }
128
129 #[tokio::test]
130 async fn repurchase_with_share_contact_clears_revocation() {
131 let mut h = TestHarness::new().await;
132
133 let (seller_id, item_id) = setup_seller_with_discountable_item(&mut h).await;
134
135 // Buyer: purchase with share_contact, then revoke
136 let _buyer_id = h.signup("buyer2", "buyer2@test.com", "password123").await;
137 buyer_purchase_with_share_contact(&mut h, &item_id).await;
138
139 let resp = h
140 .client
141 .delete(&format!("/api/contacts/{}", *seller_id))
142 .await;
143 assert_eq!(resp.status, 204);
144
145 // Confirm contact is hidden
146 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
147 .await
148 .unwrap();
149 assert!(
150 contacts.is_empty(),
151 "Contact should be hidden after revocation"
152 );
153
154 // Seller creates a second item so buyer can re-purchase with share_contact
155 h.client.post_form("/logout", "").await;
156 h.login("seller", "password123").await;
157 let project_id = {
158 let resp = h.client.get("/api/projects").await;
159 let projects: Value = resp.json();
160 projects["data"][0]["id"].as_str().unwrap().to_string()
161 };
162 let resp = h
163 .client
164 .post_form(
165 &format!("/api/projects/{project_id}/items"),
166 "title=Product+2&item_type=digital&price_cents=1000",
167 )
168 .await;
169 assert_eq!(
170 resp.status, 200,
171 "Create item 2 failed: {} {}",
172 resp.status, resp.text
173 );
174 let item2: Value = resp.json();
175 let item2_id = item2["id"].as_str().unwrap().to_string();
176 h.client
177 .put_form(&format!("/api/items/{item2_id}"), "is_public=true")
178 .await;
179
180 // Switch back to buyer and re-purchase with share_contact
181 h.client.post_form("/logout", "").await;
182 h.login("buyer2", "password123").await;
183 buyer_purchase_with_share_contact(&mut h, &item2_id).await;
184
185 // Verify revocation is cleared, seller can see contact again
186 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
187 .await
188 .unwrap();
189 assert_eq!(
190 contacts.len(),
191 1,
192 "Contact should reappear after re-purchase with share_contact"
193 );
194 assert_eq!(contacts[0].email, "buyer2@test.com");
195 }
196
197 #[tokio::test]
198 async fn export_redacts_email_after_revocation() {
199 let mut h = TestHarness::new().await;
200
201 let (seller_id, item_id) = setup_seller_with_discountable_item(&mut h).await;
202
203 // Buyer purchases with share_contact
204 let _buyer_id = h.signup("buyer3", "buyer3@test.com", "password123").await;
205 buyer_purchase_with_share_contact(&mut h, &item_id).await;
206
207 // Verify export shows email before revocation
208 let rows = db::transactions::get_seller_transactions_for_export(&h.db, seller_id)
209 .await
210 .unwrap();
211 assert!(!rows.is_empty(), "Export should have rows");
212 assert_eq!(
213 rows[0].buyer_email.as_deref(),
214 Some("buyer3@test.com"),
215 "Export should show buyer email before revocation"
216 );
217
218 // Revoke
219 let resp = h
220 .client
221 .delete(&format!("/api/contacts/{}", *seller_id))
222 .await;
223 assert_eq!(resp.status, 204);
224
225 // Verify export hides email after revocation (row still present, email NULL)
226 let rows = db::transactions::get_seller_transactions_for_export(&h.db, seller_id)
227 .await
228 .unwrap();
229 assert!(
230 !rows.is_empty(),
231 "Export should still have rows after revocation"
232 );
233 assert_eq!(
234 rows[0].buyer_email, None,
235 "Export should hide buyer email after revocation"
236 );
237 }
238
239 #[tokio::test]
240 async fn revoke_is_idempotent() {
241 let mut h = TestHarness::new().await;
242
243 let seller_id = h.signup("seller4", "seller4@test.com", "password123").await;
244 h.grant_creator(seller_id).await;
245 h.client.post_form("/logout", "").await;
246 let _buyer_id = h.signup("buyer4", "buyer4@test.com", "password123").await;
247
248 // Double revoke, both should succeed
249 let resp = h
250 .client
251 .delete(&format!("/api/contacts/{}", *seller_id))
252 .await;
253 assert_eq!(
254 resp.status, 204,
255 "First revoke should return 204, got {}",
256 resp.status
257 );
258
259 let resp = h
260 .client
261 .delete(&format!("/api/contacts/{}", *seller_id))
262 .await;
263 assert_eq!(
264 resp.status, 204,
265 "Second revoke should return 204, got {}",
266 resp.status
267 );
268 }
269
270 #[tokio::test]
271 async fn revoke_requires_auth() {
272 let mut h = TestHarness::new().await;
273
274 // Establish a session for CSRF but don't log in
275 h.client.fetch_csrf_token().await;
276
277 let fake_seller = uuid::Uuid::new_v4();
278 let resp = h
279 .client
280 .delete(&format!("/api/contacts/{fake_seller}"))
281 .await;
282 assert!(
283 resp.status == 401 || resp.status == 302 || resp.status == 303,
284 "Unauthenticated revoke should be rejected, got {}",
285 resp.status
286 );
287 }
288